Fortinet FortiMail Webmail Vulnerable to SQL Injection
Fortinet has disclosed a critical SQL injection vulnerability in its FortiMail webmail interface, allowing authenticated attackers to execute arbitrary code.
Fortinet's Product Security Incident Response Team (PSIRT) has issued an advisory detailing a critical SQL injection vulnerability affecting the webmail component of FortiMail.
The vulnerability, identified as CWE-89, allows an authenticated attacker to execute unauthorized code or commands by sending specially crafted HTTP requests to the affected webmail interface. This type of attack exploits weaknesses in how the application handles user-supplied data within SQL queries, enabling attackers to manipulate the database and, consequently, the underlying system.
The CVSSv3 score for this vulnerability is rated at 7.7, classifying it as High severity. This score reflects the potential for significant impact, including escalation of privilege, as noted in the advisory. The exploit requires an attacker to have prior authentication to the FortiMail system, but once authenticated, the path to exploitation is relatively straightforward with crafted requests.
Several versions of FortiMail are impacted by this flaw, including FortiMail 8.0, 7.6, 7.4, and 7.2. Users running these versions are strongly advised to review the advisory and apply necessary updates or mitigations.
The vulnerability was internally reported and discovered by Jaguar Perlas of the Burnaby Infosec team. While the advisory does not indicate active exploitation in the wild, the high severity and potential for code execution make it a significant risk for organizations using FortiMail.
Fortinet has assigned CVE-2025-57739 to this vulnerability. The advisory provides a direct link for further technical details and remediation guidance. Organizations are encouraged to consult the Fortinet PSIRT website for the most up-to-date information and recommended actions.
This disclosure highlights the ongoing need for diligent security practices, including regular patching and monitoring of critical infrastructure, especially for devices handling email and security functions. SQL injection vulnerabilities remain a persistent threat, capable of leading to severe data breaches and system compromise.